Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-11-2024 19:19
General
-
Target
4c91b355c0d02ffdce4751584d0a4228e51a579273e2de81f2531a6e1b8d53aa.exe
-
Size
253KB
-
MD5
a12ac26a69d523ba17cbf989cefd2480
-
SHA1
141e7c85a00cb5b2439f051d6e6b9260b5003743
-
SHA256
4c91b355c0d02ffdce4751584d0a4228e51a579273e2de81f2531a6e1b8d53aa
-
SHA512
6b9f5569c97fb9ab4e9af5217613b4d73252a517d275b0cbc1718a3b98d14a59b943e2443cf4bd53bd11727db286af86a382bddea34ac5c63c545d6b99717bc1
-
SSDEEP
6144:HL9OPaZNgaeZ1l+M3U3OlMavK0h06bItP:HxOp1lLGOaaSn6b
Score
10/10
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
77.105.160.30
185.172.128.69
Signatures
-
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
-
Gcleaner family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c91b355c0d02ffdce4751584d0a4228e51a579273e2de81f2531a6e1b8d53aa.exe"C:\Users\Admin\AppData\Local\Temp\4c91b355c0d02ffdce4751584d0a4228e51a579273e2de81f2531a6e1b8d53aa.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
240KB
-
Filesize
256KB
-
Filesize
1024KB
-
Filesize
240KB
-
Filesize
876KB
-
Filesize
256KB